PT-2023-26342 · Unknown · Bug Finder Listplace Directory Listing Platform

Name of the Vulnerable Software and Affected Versions: Bug Finder Listplace Directory Listing Platform version 3.0 Description: A vulnerability was found in the Bug Finder Listplace Directory Listing Platform, affecting an unknown part of the file /listplace/user/coverPhotoUpdate of the component...

PT-2023-26338 · Ibos Oa · Ibos Oa

Name of the Vulnerable Software and Affected Versions: IBOS OA version 4.5.5 Description: A critical issue has been found in the Interview Handler component, specifically in the file /api/v1/recruit/resume/edit&op=status. The manipulation of the resumeid argument leads to SQL injection. This issu...

PT-2023-26372 · Unknown · Bug Finder Ex-Rate

Name of the Vulnerable Software and Affected Versions: Bug Finder EX-RATE version 1.0 Description: A vulnerability was found in the Ticket Handler component, affecting some unknown functionality of the file /user/ticket/create. The manipulation of the message argument leads to cross-site scriptin...

PT-2023-26321 · Unknown · Y Project Ruoyi

Name of the Vulnerable Software and Affected Versions: y project RuoYi versions up to 4.7.7 Description: A vulnerability has been found in the function uploadFilesPath of the component File Upload. The manipulation of the argument originalFilenames leads to cross site scripting. The attack may be...

PT-2023-26183 · Kubepi · Kubepi

Name of the Vulnerable Software and Affected Versions: KubePi versions prior to 1.6.5 Description: The issue concerns the leakage of password hashes for any user, including administrators, through the /kubepi/api/v1/users/search endpoint. This could allow a motivated attacker to crack the leaked...

PT-2023-26217 · Gen Technology · Gen Technology Four Mountain Torrent Disaster Prevention/Control Of Monitoring/Early Warning System

Name of the Vulnerable Software and Affected Versions: Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Warning System up to 20230712 Description: A critical issue was found in the system, affecting the /Duty/AjaxHandle/UploadFloodPlanFileUpdate.ashx...

PT-2023-26244 · Unknown · Easyadmin8

Name of the Vulnerable Software and Affected Versions: EasyAdmin8 version 2.0.2.2 Description: A vulnerability has been found in the File Upload Module of EasyAdmin8, affecting an unknown function of the file /admin/index/index.html/admin/mall.goods/index.html. This issue leads to unrestricted...

PT-2023-12243 · Htmodoc +3 · Htmodoc +3

Name of the Vulnerable Software and Affected Versions: htmodoc version 1.9.12 Description: A flaw was discovered in the parse paragraph function in ps-pdf.cxx, which possibly allows code execution and a denial of service via a crafted file. Recommendations: For version 1.9.12, consider restrictin...

PT-2023-12244 · Htmodoc +3 · Htmodoc +3

Name of the Vulnerable Software and Affected Versions: htmodoc version 1.9.12 Description: An Out of Bounds flaw was discovered in the parse tree function in toc.cxx, which possibly leads to memory layout information leaking in the data. This might be used in a chain of issues to reach code...

PT-2023-4053

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 11.0.19, 17.0.7, 20.0.1 Oracle GraalVM Enterprise Edition versions 20.3.10, 21.3.6, 22.3.2 Oracle GraalVM for JDK versions 17.0.7, 20.0.1 Description The issue is related to the Networking component of the affected...

PT-2023-12541 · What3Words · What3Words Autosuggest Plugin

Name of the Vulnerable Software and Affected Versions: what3words Autosuggest Plugin versions up to 4.0.0 Description: A vulnerability has been found in the what3words Autosuggest Plugin, classified as problematic. The issue affects the enqueue scripts function of the file...

CVE-2023-37266

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...

PT-2023-17320 · WordPress · Login Configurator

Name of the Vulnerable Software and Affected Versions: Login Configurator WordPress plugin versions through 2.1 Description: The issue is related to a reflected cross-site scripting vulnerability. It occurs because the plugin does not properly escape a URL parameter before outputting it to the...

PT-2023-25602 · WordPress · Woocommerce Order Barcodes

Name of the Vulnerable Software and Affected Versions: WooCommerce Order Barcodes plugin versions 1.6.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2023-24477

Name of the Vulnerable Software and Affected Versions Zekiweb versions prior to 2 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations For versions prior...

CasaOS contains weak JWT secrets

Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances...

PT-2023-25737 · Unknown · Bylancer Quickorder

Name of the Vulnerable Software and Affected Versions: Bylancer QuickOrder version 6.3.7 Description: A critical issue has been found in the GET Parameter Handler component of the /blog file, where the manipulation of the s argument leads to sql injection. This issue can be exploited remotely. Th...

PT-2023-25736 · Bylancer · Bylancer Quickqr

Name of the Vulnerable Software and Affected Versions: Bylancer QuickQR version 6.3.7 Description: A critical issue was found in the GET Parameter Handler component of the /blog file, where the manipulation of the s argument leads to sql injection. This issue can be exploited remotely. The vendor...

PT-2023-25711 · Unknown · Nesote Inout Blockchain Easypayments

Name of the Vulnerable Software and Affected Versions: Nesote Inout Blockchain EasyPayments version 1.0 Description: A critical issue was found in the POST Parameter Handler component of the /index.php/payment/getcoinaddress file. The manipulation of the coinid argument leads to sql injection,...

PT-2023-26346 · Thymeleaf +1 · Thymeleaf +1

Name of the Vulnerable Software and Affected Versions: Thymeleaf versions 3.1.1.RELEASE and earlier spring-boot-admin versions 3.1.1 and earlier Description: The issue allows for a sandbox bypass via crafted HTML, which may be relevant for Server Side Template Injection SSTI and code execution in...